GC2-sheet

GC2 GC2 Google Command and Control is a Command and Control application that allows an attacker to execute commands on the target machine using Google Sheet or Microsoft SharePoint List and exfiltrate files using Google Drive or Microsoft SharePoint Document. Why This project has been developed t...

CVE-2025-53770

Microsoft SharePoint CVE-2025-53770 POC DISCLAIMER: This code/payload is provided for educational purposes only. The author does not condone or support any unauthorized or malicious use of this code. Use it only in environments you own or have explicit permission to test. Misuse may violate laws...

CVE-2026-45659

CVE-2026-45659 Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. ⚡ Simple Usage Use this project only in safe and authorized environments such as: Local virtual machines Docker containers Isolated lab setups Authorized...

CVE-2023-24955-PoC

CVE-2023-24955-PoC Exploit for Microsoft SharePoint 2019 An exploit published for a vulnerability named CVE-2023-24955 .I saw the code and There was some bug in the resolveTargetInfo and getOAuthInfo . Then I fixed it and it's for u now. ❗❗❗❗❗❗ Remember that you should run it with Python2 I tried...

CVE-2019-0604

CVE-2019-0604 CVE-2019-0604 From https://www.thezdi.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability...

CVE-2026-50522

CVE-2026-50522 Microsoft SharePoint CVE-2026-50522 payloads and analysis. HTTP requests request| src| user-agent| encoding| unique id| payload ---|---|---|---|---|--- 816978882| 45.63.58.216| Mozilla/5.0 Windows NT 10.0; Win64; x64 AppleWebKit/537.36| '|...

ZeroPoint

ZeroPoint.ps1 ⚠ A defensive PowerShell utility to detect and mitigate exploitation of the CVE-2025-53770 zero-day vulnerability in Microsoft SharePoint Server. 🔍 What it Does This PowerShell script is designed to: Detect compromise indicators, such as suspicious .aspx webshells Parse ULS logs to...

sharepoint-deserialization-security-assessment

CVE-2026-45659 - Microsoft SharePoint Deserialization RCE Consultant-Style Cybersecurity Report Professional vulnerability assessment report for SharePoint deserialization risk, including executive summary, technical impact, remediation, and mitigation strategy. 📍 Report Snapshot Field| Details...

suricata-rule-CVE-2025-53770

suricata-rule-CVE-2025-53770 Detection rules for CVE-2025-53770 alert http $EXTERNALNET any - $HOMENET any msg: "ET EXPLOIT SharePoint RCE ToolShell CVE-2025-53770"; http.method; content: "POST"; flow: established, toserver; http.uri;...

CVE-2026-65660-Poc

MS SharePoint CVE-2026-65660 - Malicious Register Directive Code Injection Exploit Description This repository provides a production-ready exploit for CVE-2026-65660 Improper Control of Generation of Code, CWE-94 in Microsoft SharePoint Server. The vulnerability stems from unescaped quote injecti...

SOC227-Microsoft-SharePoint-Server-Elevation-of-Privilege-Possible-CVE-2023-29357-Exploitation

SOC227 - Microsoft SharePoint Server Elevation of Privilege CVE-2023-29357 Exploitation CVE-2023-29357 is a critical privilege escalation vulnerability that, when combined with other vulnerabilities, could potentially lead to remote code execution. The CVSS score for this vulnerability is 9.8...

CVE-2026-50522

🛡️ CVE-2026-50522 — Microsoft SharePoint RCE Investigation Critical SharePoint Deserialization Vulnerability Under Active Exploitation Created by Pratik Chhetri Report Date: 2026-07-27 📌 Executive Snapshot Field| Finding ---|--- Vulnerability| CVE-2026-50522 Product| Microsoft SharePoint Server...

ToolShellFinder

🛠️ ToolShellFinder: CVE-2025-53770 & CVE-2025-53771 Detection A high-performance PowerShell 7+ script for scanning IIS logs to detect signs of exploitation related to ToolShell , specifically targeting the zero-day vulnerabilities CVE-2025-53770 and CVE-2025-53771 in Microsoft SharePoint. This...

CVE-2026-55040

Microsoft SharePoint JWT Authentication Bypass CVE-2026-55040 Overview CVE-2026-55040.py is a proof-of-concept script to leverage the SharePoint authentication bypass vulnerability, CVE-2026-55040. For a full technical analysis, see our Rapid7 Analysis. Usage $ python CVE-2026-55040.py --help...

mssharepoint-scanner

MS SharePoint Scanner A single-file, dependency-free defensive tool for Microsoft SharePoint that combines service discovery single or bulk with CVE assessment for two critical on-premises vulnerabilities: CVE-2026-55040 Critical 9.1 — JWT token authentication bypass CVE-2026-63520 High 8.1 —...

MS-SharePoint-July-Patch-RCE-PoC

MS-SharePoint-July-Patch-RCE-PoC PoC for: CVE-2024-38094 CVE-2024-38024 CVE-2024-38023 PoC Video: https://youtu.be/u8mccaakISw...

CVE-2026-55040-Mass-Exploit

JWT Token Bypass Exploit for Microsoft SharePoint CVE-2026-55040, CVSS 9.1. Forge authentication tokens using three attack vectors: Algorithm "none" skips signature verification Weak HS256 secrets with brute-force dictionary support RS256 key substitution Impersonate any user including...

CVE-2026-63520

CVE-2026-63520 Sharepoint unsafe type RCE + CVE-2026-55040 chain Unauthenticated RCE on Microsoft SharePoint Server. No credentials needed. Stephen Fewer Rapid7 demonstrated CVE-2026-55040 at Pwn2Own Berlin 2026. Rapid7 then discovered CVE-2026-63520 during follow-up research, and VulnCheck...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...

CVE-2023-29357-Check

CVE-2023-29357 Microsoft SharePoint Server Elevate Privilege Vulnerability This script will tell you if the target is vulnerable to CVE-2023-29357 Usage python3 script.py Disclaimer This script is for educational purposes only. Do not use it against targets without prior mutual consent. Reference...